In order to speed up DNS lookups, I want to install a DNS cache or proxy.

I can see at least three programs I think will do the job: bind9, pdnsd, or dnsmasq.

I would like to make sure that if I install one of I do not leave it poorly configured from a performance or security point of view. So, what would people recommend, and are there any configuration changes I should immediately make after installing?

Thanks, Igor. I tried this approach and it works well for name lookups, but it does not seem to cache reverse IP address lookups. How would I do this using bind9?
–
user8979Jan 25 '11 at 21:35

This didn't do anything on my setup. Query time is still ~100ms
–
AshfameApr 21 '11 at 6:48

Both of you: if it doesn't seem to work, check what server dig says it got the answer from. If it doesn't say 127.0.0.1, then you haven't set it up properly. Note: The instructions for setting resolv.conf may be different for different versions of Ubuntu.
–
thomasrutterDec 10 '12 at 0:17

"In order to speed up DNS lookups, I want to install a DNS cache or proxy."

Ok. But there's an easier way, too. Using OpenDNS and/or Google name servers will be faster than your own local cache for names that already exist in the OpenDNS/Google caches. Using 208.67.222.222, 208.67.220.220, and/or 8.8.8.8 as name serves will be faster almost all of the time. You can test this with time nslookup www.google.com 208.67.222.222 to test speed on one of the OpenDNS name servers, time nslookup www.google.com 8.8.8.8 for Google, or time nslookup www.google.com 127.0.0.1 on your local cache. When I say faster, I mean technically faster and not so much faster that a person could easily notice a difference.

"I can see at least three programs I think will do the job: bind9, pdnsd, or dnsmasq."

Are you open to the dnscache portion of djbdns? Instructions below. Though, it does not save the cache without a patch...

Edit the file to look like this example. This file defines which name servers to use, the default domain, and the search suffix. The search suffix makes it possible to run queries using only the hostname portion of a fully-qualified domain name. For exmaple, 'nslookup www' automagically becomes 'nslookup www.example.com' when example.com is the value of the "search" parameter.

I think the resolv.conf file is overwritten when we use DHCP. I choose to give myself a static IP address and remove the software that squashes it, editing the interfaces file to set up the static IP address. But you could try to work with Network Manager if you are so inclined.

Now you are using a local resolver and the latest root servers. But you'll notice if you try that OpenDNS and Google are in fact answering faster (for names that are in their caches, which is all of the most popular domains). There is no additional configuration that could cause the software to become any more secure that it already is.

Thanks Christopher. Can you explain why Google DNS is faster than my local cache? I believe its fast, but how could it be faster to go all the way to their server than to go my local cache?
–
Eric JohnsonApr 27 '11 at 7:16

Because chances are very good that it already has the answer without having to look it up again.
–
user8290Jul 15 '11 at 19:34

@Christopher: But once your local cache has it, the lookups are instant. If you use Google DNS you have to wait 80 ms every single time you do a query.
–
Zan LynxDec 9 '11 at 0:59

Although @user8290 has a point, I wouldn't say using GoogleDNS is faster than a local one. Yeah, google has the results cached, but come on - if your international speed sucks, it doesn't matter even if Google had all the DNS results in the world. Local networks usually have 100mbps+ so asking the your local network dns server for an answer will be at least 10 times faster than asking 8.8.8.8/8.8.4.4 (depending on your international speed). Of course this is in terms you have the result cached on your DNS server.
–
tftdJun 4 '13 at 2:10

I'm using "dnscache" (package "dnscache-run") and it's very simply. No need to configure anything.
It captures the DNS petitions (port 53) and it caches the responses, the next time that Linux ask for that domain, dnscache returns the IP immediately.
Although there are two parameters that can be changed to improve this program:

Whichever tool you use, ensure that port 53 is not enabled incoming on your firewall. You may want to allow only the host with the cache outbound access.

DNSMasq is easy to setup, and well documented. If you install it on a firewall, specify the interfaces to bind to excluding the Internet interface.

Bind is more difficult to configure and may be overkill for as a cache for a small network. I believe the default configuration is caching only. You may want to add an ACL to restrict which addresses can use your server.